{
  "id": "dragonfly",
  "name": "Dragonfly",
  "aliases": [
    "TEMP.Isotope",
    "DYMALLOY",
    "Berserk Bear",
    "TG-4192",
    "Crouching Yeti",
    "IRON LIBERTY",
    "Energetic Bear",
    "Ghost Blizzard",
    "BROMINE"
  ],
  "domain": "cyber",
  "country": "RUS",
  "category": "State-sponsored cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "RUS"
  ],
  "summary": "Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16. Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Russia's Federal Security Service (FSB) Center 16",
      "src": [
        "mitre-g0035"
      ],
      "conf": "high"
    },
    {
      "k": "active_since",
      "v": 2010,
      "src": [
        "mitre-g0035"
      ],
      "conf": "medium",
      "note": "At least 2010"
    },
    {
      "k": "attack_id",
      "v": "G0035",
      "src": [
        "mitre-g0035"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.",
      "src": [
        "mitre-g0035"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 56,
      "src": [
        "mitre-g0035"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "Backdoor.Oldrea, CrackMapExec, Impacket, MCMD, Mimikatz, Net, netsh, PsExec, Reg, Trojan.Karagany",
      "src": [
        "mitre-g0035"
      ],
      "conf": "high",
      "note": "10 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16. Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0035)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/dragonfly.html",
  "sources": {
    "mitre-g0035": {
      "title": "Dragonfly, Group G0035",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0035/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}